FaceStealer: How DPRK Hackers Stole $400M in Crypto via Deepfake Video Calls — Detection and Defense Guide

---
title: Browser or Meeting Client Spawning Script Interpreter or Downloader
id: 3f8a1c92-6d4e-4b7a-9c51-2e7d8f0a1b34
status: experimental
description: Detects browsers and video conferencing clients spawning curl, PowerShell, Python, or Node processes, consistent with FaceStealer-style fake meeting-update malware delivery where users are instructed to run commands or download payloads during a call.
references:
  - https://thehackernews.com/2026/11/fbi-says-north-korean-hackers-stole.html
  - https://attack.mitre.org/techniques/T1204/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\Zoom.exe'
      - '\Teams.exe'
      - '\msedgewebview2.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\curl.exe'
      - '\python.exe'
      - '\pythonw.exe'
      - '\node.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Browser extensions or enterprise meeting add-ins invoking helpers
  - Developer workflows launching local servers from browser-based IDEs
level: high
---
title: Download Cradle Executing Payload From User Staging Directory
id: 8b2e5d14-3a9f-4c68-b7d2-5f1a9e0c6d83
status: experimental
description: Detects download-and-execute patterns where a payload is fetched to Downloads, Temp, or AppData and immediately executed, matching the fake audio/video driver or SDK update lure used in DPRK FaceStealer social engineering.
references:
  - https://thehackernews.com/2026/11/fbi-says-north-korean-hackers-stole.html
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.command_and_control
  - attack.t1105
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  selection_cli_download:
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
      - 'wget '
      - 'curl.exe '
      - 'Start-BitsTransfer'
      - '-urlcache'
  selection_cli_path:
    CommandLine|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '$env:TEMP'
      - '$env:APPDATA'
  condition: selection_img and selection_cli_download and selection_cli_path
falsepositives:
  - Software deployment tooling (SCCM, Intune) — filter on known admin service accounts
  - Developer package managers
level: high
---
title: Crypto Wallet Browser Extension Data Access or Modification
id: c41d7f26-8e3b-4a59-9d06-7c2b5e8f3a19
status: experimental
description: Detects non-browser processes reading or modifying browser extension storage associated with cryptocurrency wallets (e.g., MetaMask), consistent with FaceStealer wallet credential and seed phrase theft.
references:
  - https://thehackernews.com/2026/11/fbi-says-north-korean-hackers-stole.html
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.credential_access
  - attack.t1552.001
  - attack.t1539
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\nkbihfbeogaeaoehlefnkodbefgpgknn\'
      - '\ejbalbakoplchlghecdalmeeeajnimhm\'
      - '\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn'
  filter_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\firefox.exe'
  condition: selection_path and not filter_browser
falsepositives:
  - Backup and sync agents (OneDrive, backup software) touching profile directories
  - Endpoint DLP scanning
level: high

// FaceStealer hunt: browsers/meeting clients spawning script interpreters or downloaders,
// plus interpreters executing from user staging directories, joined to recent downloads.
let suspiciousChildren = dynamic(["powershell.exe","pwsh.exe","curl.exe","python.exe","pythonw.exe","node.exe","cmd.exe","wscript.exe","mshta.exe","rundll32.exe"]);
let parentApps = dynamic(["chrome.exe","msedge.exe","firefox.exe","brave.exe","Zoom.exe","Teams.exe","msedgewebview2.exe"]);
let stagingPaths = dynamic([@"\Downloads\", @"\AppData\Local\Temp\", @"\AppData\Roaming\", @"\AppData\Local\"]);
let procHits =
    DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where (InitiatingProcessFileName in~ (parentApps) and FileName in~ (suspiciousChildren))
        or (FileName in~ (suspiciousChildren)
            and ProcessCommandLine has_any (stagingPaths)
            and ProcessCommandLine has_any ("http://","https://","Invoke-WebRequest","Invoke-RestMethod","Start-BitsTransfer","wget","curl"))
    | project DeviceId, DeviceName, AccountName, TimeGenerated,
        ChildProc = FileName, ChildCmdLine = ProcessCommandLine,
        ParentProc = InitiatingProcessFileName, ParentCmdLine = InitiatingProcessCommandLine,
        SHA256, ReportId;
procHits
| join kind=leftouter (
    DeviceFileEvents
    | where TimeGenerated > ago(30d)
    | where ActionType == "FileCreated" and FolderPath has_any (stagingPaths)
    | project DeviceId, FileCreatedTime = TimeGenerated, FileName, FolderPath, SHA256
) on DeviceId, SHA256
| project-away DeviceId1, SHA256_1
| sort by TimeGenerated desc

// Linux/macOS developer workstations: curl/wget piped to shell or python from user dirs
Syslog
| where TimeGenerated > ago(30d)
| where ProcessName in~ ("bash","sh","zsh","python","python3","curl","wget")
| where SyslogMessage has_any ("curl", "wget")
    and SyslogMessage has_any ("| sh", "| bash", "| python", "/tmp/", "/Downloads/", "chmod +x")
    and SyslogMessage has_any ("http://", "https://")
| project TimeGenerated, Computer, HostName, ProcessName, SyslogMessage
| sort by TimeGenerated desc

-- FaceStealer hunt: executables and scripts staged in user directories and recently executed
LET staging_globs = "C:/Users/*/{Downloads,AppData/Local/Temp,AppData/Roaming}/**/*.{exe,msi,dll,ps1,js,py,jar,sh,pkg,command}"
LET staged = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=staging_globs)
WHERE Mtime > now() - 60*86400

LET running = SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(Downloads|AppData\\(Local\\Temp|Roaming|Local))'

SELECT * FROM staged
UNION ALL
SELECT Exe AS FullPath, NULL AS Size, CreateTime AS Mtime, NULL AS Btime FROM running

-- Enumerate Chrome/Edge wallet extensions (MetaMask et al.) and flag unexpected extension IDs
SELECT FullPath, Mtime,
       basename(path=dirname(path=FullPath)) AS ExtensionID
FROM glob(globs='C:/Users/*/AppData/Local/{Google/Chrome,Microsoft/Edge}/User Data/*/Local Extension Settings/*')
WHERE ExtensionID !~ '^(nkbihfbeogaeaoehlefnkodbefgpgknn|ejbalbakoplchlghecdalmeeeajnimhm)$'
   OR Mtime > now() - 14*86400

# FaceStealer endpoint audit: browser extensions, staged unsigned binaries, script policy
# Requires: local admin. Safe to run read-only; makes no changes.

$report = @()

# 1. Enumerate Chromium extension IDs across all user profiles
$extRoots = @(
    "$env:SystemDrive\Users\*\AppData\Local\Google\Chrome\User Data\*\Extensions",
    "$env:SystemDrive\Users\*\AppData\Local\Microsoft\Edge\User Data\*\Extensions"
)
foreach ($root in $extRoots) {
    Get-ChildItem $root -ErrorAction SilentlyContinue -Directory | ForEach-Object {
        $report += [pscustomobject]@{
            Check = 'BrowserExtension'
            Path  = $_.FullName
            Value = $_.Name
            Note  = 'Verify this extension ID is approved by IT; wallet extensions are prime theft targets'
        }
    }
}

# 2. Flag unsigned executables/scripts staged in user-writable directories (last 60 days)
$staging = @("$env:SystemDrive\Users\*\Downloads", "$env:SystemDrive\Users\*\AppData\Local\Temp")
foreach ($dir in $staging) {
    Get-ChildItem $dir -Recurse -Include *.exe,*.msi,*.ps1,*.js,*.dll -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-60) } | ForEach-Object {
            $sig = Get-AuthenticodeSignature $_.FullName
            if ($sig.Status -ne 'Valid') {
                $report += [pscustomobject]@{
                    Check = 'UnsignedStagedBinary'
                    Path  = $_.FullName
                    Value = $sig.Status
                    Note  = 'Unsigned payload in staging dir — investigate delivery source (meeting lure?)'
                }
            }
        }
}

# 3. Verify PowerShell execution policy and script block logging
$policy = Get-ExecutionPolicy -List
$sbl = Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -ErrorAction SilentlyContinue
$report += [pscustomobject]@{
    Check = 'ScriptControls'
    Path  = 'HKLM PowerShell policy'
    Value = "ScriptBlockLogging=$($sbl.EnableScriptBlockLogging)"
    Note  = 'ScriptBlockLogging should be 1; enforce Constrained Language or AppLocker where possible'
}

$report | Format-Table -AutoSize
$report | Export-Csv "$env:TEMP\facestealer_audit.csv" -NoTypeInformation
Write-Output "Audit complete: $($report.Count) findings -> $env:TEMP\facestealer_audit.csv"